Cloudanix VulnDB

CVE-2026-68254

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel handles certain monitor settings could cause computers with Intel graphics to crash when variable refresh rate is turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Invalid (zero) min_vfreq value from EDID input bypasses prior checks and triggers division-by-zero in intel_vrr_compute_vmax() during VRR mode setup.

Why it matters to the business

Systems using Intel i915 graphics with certain monitors may experience kernel panics or instability when VRR is enabled, leading to unexpected downtime and loss of graphical sessions.

How an attack unfolds

An attacker supplies a crafted EDID with a zero min_vfreq value (via malicious monitor, firmware, or userspace display emulation) that reaches the VRR validation path, causing the kernel to crash during intel_vrr_compute_vmax().

How to fix it

Apply the upstream fix that adds explicit validation of EDID min/max vfreq values before VRR computation; rebuild and deploy the patched kernel.

How to confirm the fix worked

Confirm the presence of the added min/max vfreq validity checks in drm/i915/vrr.c and test with displays that previously reported zero vfreq values.

Typical attack path

  1. Attach or emulate a display device presenting an EDID with min_vfreq set to zero
  2. Trigger VRR capability checks and range validation in the i915 driver
  3. Invoke intel_vrr_compute_vmax() which performs division by the zero value
  4. Cause kernel panic or denial of service

How to detect it

Review kernel logs for division-by-zero faults or oops traces mentioning intel_vrr_compute_vmax or vrr; correlate with recent display hot-plug or mode-set events.

What your security team should do

  • Prioritize kernel updates on all Intel i915-based systems that enable VRR
  • Monitor for kernel oops or division-by-zero reports in dmesg related to vrr
  • Disable VRR on affected hardware until patches are applied if stability is critical

The record

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vrr: require valid min/max vfreq for VRR Ensure the EDID provided min/max vfreq are valid. Most scenarios are already covered (by coincidence) through the checks in intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit about it. At worst, a zero min_vfreq could lead to a division by zero in intel_vrr_compute_vmax(). Discovered using AI-assisted static analysis confirmed by Intel Product Security. (cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)

Affected packages

Ecosystem Package Introduced Fixed